machina-auth 1.0.0 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 64cd50975d04d89620d0ad73d6be045f93256efc4d34c57a563782167e659dc2
-  data.tar.gz: 3a962c88b3b58a015fb267de869acc17575cf7377df37b1bfe4439c0bbc66eba
+  metadata.gz: 2b6572b3ef8cb554a701292ebeca7442e4267c7fea9f3c8fc8635067f02ce6fc
+  data.tar.gz: 0e25ba27df749426535443c1c8ff5b165e1ed02658d15ced035f9256b3ed731f
 SHA512:
-  metadata.gz: b8962c63372568bacb6c6afa2ea47a0530999c0299a39117cbeefee5cec676f81fa25eba413aa3f093e26201878446412a4c9a5fac7f5df7604a13f6078876cf
-  data.tar.gz: 5cc1964cc2c24e6f4d3ddd9e45334bd2dec68a59fdeb73c85ccfc604cd4d19c49094ab6decec799c2d71862f88bd37e8310c1e1801d4d0c5d85cbb383f4ef956
+  metadata.gz: 19fb58e16fd547814694f94b976ad0baebd1fb2740ffabf709c28a6ed6ab614bb75ad58ac40743d791c51cbf1840700baad43c63ba4bc5518551d6d3a6eb60db
+  data.tar.gz: 9e710c4519b897849a7d29dd0b93663a94627b5141d89893493decb2f16d3de4d9621b25db6080cae340916cf4b92c860dba6d9e5fe8a21350e7820f30229d57

data/app/controllers/machina/callbacks_controller.rb

@@ -39,11 +39,12 @@ module Machina
       }
     end
 
-    # Relative paths only — an absolute or protocol-relative return_to is an
-    # open redirect on a credential-bearing request.
+    # Relative paths only. Reject a leading // or /\ — browsers treat both as
+    # protocol-relative, so either is an open redirect on a credential-bearing
+    # request (a backslash also trips Rails' UnsafeRedirectError as a 500).
     def safe_return_to
       value = params[:return_to].to_s
-      return value if value.start_with?('/') && !value.start_with?('//')
+      return value if value.start_with?('/') && !value.match?(%r{\A/[/\\]})
 
       '/'
     end

data/lib/machina/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Machina
-  VERSION = '1.0.0'
+  VERSION = '1.0.1'
 end

data/spec/requests/machina/callbacks_spec.rb

@@ -68,6 +68,12 @@ RSpec.describe Machina::CallbacksController, type: :controller do
 
       expect(response).to redirect_to('/')
     end
+
+    it 'rejects a backslash protocol-relative return_to' do
+      get :show, params: { token:, state:, return_to: '/\\evil.example.com' }
+
+      expect(response).to redirect_to('/')
+    end
   end
 
   describe 'with an invalid state' do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: machina-auth
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors:
 - ZAR